1

I am interested in storing certificates for various purposes on a SmartCard. Since this answer illustrates how there are confusing differences and similarities between RSA and AES

When should one class be used over the other to get the most interoperability? If the class doesn't matter so much as the settings, what settings are most appropriate.

My intent is to understand which API (and corresponding settings) is best used cross platform, and across API (Java, 3rd party). I would have posted this on the Crypto forum, but that appears to be more about theory and less about coding.

1

This is the only relevant part:

" RijndaelManaged class is a kind of implementation of Rijndael algorithm in .net framework, which was not validated under NIST (National Institute of Standards and Technology) Cryptographic Module Validation Program (CMVP).
However, AesCryptoServiceProvider class calls the Windows Crypto API, which uses RSAENH.DLL, and has been validated by NIST in CMVP. "

You should use the one that met the NIST specifications. Else there is no way to prove that the RSA algorithm is as secure as you think it is, or if it is compatible with other RSA implementations.

  • Thank you. I kinda assumed this was the answer, but see many people recommend RSA crypto provider by mistake, and not the AES. I suppose really only "asked" the question because I want people aware of the similarities, and differences between the two providers. – technology_is_overrated Jun 4 '12 at 18:37
  • @makerofthings7 It isn't to say RSA is flawed, it is the implementation that is within the .NET framework that is a problem. Ideally this is highlighted in the .NET documentation and has a compiler warning as well. – Woot4Moo Jun 4 '12 at 19:13
0

I apologize for answering a very old question, but this came in a search of mine and the selected answer is incorrect. Perhaps the chosen answer speaks to the OP's real question, but the question as stated is about RSACryptoServiceProvider vs AESCryptoServiceProvider, while the answer is about RjindaelManaged vs AESCryptoServiceProvider

RjindaelManaged is an implementation of Rjindael's algorithm that was later selected to become the basis of the AES encryption standard by NIST. AESCryptoServiceProvider is the best choice for implementing the AES/Rjindael algorithm. AES and Rjindael are both symmetric ciphers.

RSA, the Rivest–Shamir–Adleman cipher system, is an entirely different asymmetric cipher. It is completely unrelated to AES/Rjindael.

The correct answer to when to use RSACryptoServiceProvider vs AESCryptoServiceProvider depends on using an asymmetric vs symmetric cipher.

In RSA, you have a public and private key pair. If you want to have a public key to exchange, or if you want your key signed by another party, you want RSA. But RSA is comparatively slow and done properly is one-way: The public key encrypts, the private key decrypts.

If you have a lot of text you want to encrypt, you want AES. It's much faster, and many computers are optimized for it. But there's only one key. Anyone with the key can both encrypt and decrypt, which makes sharing the key safely a priority.

For the best of both worlds, use an RSA public to encrypt and transmit an AES key and then communicate using AES.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.